Future Breaches and Past Disasters: Volunteering with ITDRC

Future Breaches and Past Disasters: Volunteering with ITDRC

Speakers: Impos73r

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=wXbnUm88IJw

Overview

In his ShmooCon talk, "Future Breaches and Past Disasters: Volunteering with ITDRC," speaker Impos73r (Ian Furr) provided a compelling look into the critical, often unsung, work of the Information Technology Disaster Resource Center (ITDRC). This volunteer-run non-profit bridges a vital gap in disaster response, deploying skilled IT professionals and essential equipment to communities grappling with the aftermath of natural calamities and, increasingly, cyber incidents. Furr, a dedicated voluntech and deputy director for ITDRC's Region 3, illuminated the organization's history, diverse operations, and the profound impact its volunteers have on restoring connectivity and hope.

The talk underscored the evolving landscape of disaster response, highlighting how the need for immediate and robust IT infrastructure is as crucial as food, water, and shelter. Beyond traditional disaster relief, Furr detailed ITDRC's expansion into addressing the repercussions of large-scale cyber events through its nascent Cyber Incident Support Team (CIST). This forward-thinking initiative positions ITDRC at the forefront of a new frontier in incident response, recognizing that digital infrastructure is just as vulnerable and essential to community recovery as physical infrastructure.

Furr’s presentation serves as both an informative exposé on ITDRC's operations and a powerful call to action for cybersecurity professionals. It emphasizes that the skills honed in defending networks can be directly applied to rebuilding them in times of crisis, whether physical or digital. For attendees, the talk offered not just insights into a unique volunteer opportunity but also a stark reminder of the fundamental role technology plays in sustaining modern society, especially when disaster strikes.

Background

▶ Watch: Talk introduction and speaker welcome (6:00)

The Information Technology Disaster Resource Center (ITDRC) was founded in the late 2000s, around 2008, by individuals who identified a critical void in disaster relief efforts. While participating in field operations with other groups, they observed a significant deficit in specialized IT skills available to support communities in crisis. Recognizing that modern society's reliance on connectivity meant that IT infrastructure was as vital as any other utility, they established ITDRC to specifically address these unmet technological needs. The organization was built on the principle of bringing both skilled people and necessary equipment to get affected communities back online and reconnected to the world.

ITDRC has since grown into a formidable national presence, boasting over 5,000 volunteers distributed across all 10 FEMA regions. This extensive network allows for rapid deployment and sustained support wherever disaster strikes. To amplify its capabilities, ITDRC has forged partnerships with numerous technology companies, forming what is known as the Tech Task Force. These corporate partners contribute both essential equipment and, crucially, allow their employees to volunteer their time on the clock, providing a robust pipeline of resources and expertise. The impact of ITDRC's work is substantial; in 2023 alone, the organization assisted nearly a million people, deployed equipment to over 1,500 sites, and provided close to $3 million worth of hardware, ranging from basic patch cords to sophisticated mesh Wi-Fi networks and point-to-multipoint wireless bridges.

Speaker Ian Furr, known as Impos73r, embodies the spirit of ITDRC. As a voluntech, he is one of the dedicated individuals who deploys to disaster areas. His commitment extends to leadership roles, serving as the deputy director for ITDRC's Region 3, overseeing operations in states like DC, Delaware, Maryland, Pennsylvania, Virginia, and West Virginia. Professionally, Furr is a senior cybersecurity automation and integrations engineer at the Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC), where he applies his expertise to secure critical infrastructure. Outside of his day job, he volunteers as an EMT in Fairfax County and contributes to a communications cache in Virginia, demonstrating a broad dedication to public service and emergency response that perfectly aligns with ITDRC's mission.

ITDRC's services are comprehensive, extending far beyond simple network setups. While basic network deployments are their bread and butter, their volunteers possess a wide array of skills, including VoIP specialists, systems engineering experts, WISP (Wireless Internet Service Provider) professionals, and individuals capable of conducting open source intelligence (OSINT). This OSINT capability is crucial for identifying areas of concentrated damage, locating available resources, and strategically planning deployments. This diverse skill set allows ITDRC to tackle complex, multi-campus, multi-building setups, ensuring consistent and quality network engineering in the most challenging environments.

Key Findings

▶ Watch: ITDRC's national presence and 2023 impact statistics (10:00)

The central finding presented by Impos73r is the indispensable role of dedicated, adaptable IT support in comprehensive disaster recovery. ITDRC's operations reveal that restoring connectivity is not merely a convenience but a fundamental pillar of humanitarian aid, enabling communication, coordination, and access to vital information for affected populations and responders alike. This need spans the spectrum from basic internet access for displaced individuals to sophisticated network infrastructure for command centers and distribution hubs.

A critical insight from ITDRC's field experience is the paramount importance of troubleshooting and the ability to "think on their feet." As Furr highlighted through personal anecdotes, meticulously planned deployments often encounter unforeseen challenges in real-world disaster zones. The ability of volunteers to improvise solutions, consult technical documentation under pressure, and adapt network architectures on the fly is more valuable than rigid adherence to pre-conceived plans. This underscores that practical problem-solving skills, rather than just theoretical knowledge, are key to effective disaster response.

Furthermore, the talk revealed ITDRC's expanding scope beyond conventional natural disaster relief. The organization actively participates in planned events, such as "the World Games," demonstrating its capacity to support large-scale temporary infrastructure needs. More uniquely, ITDRC has responded to specific humanitarian crises like providing Wi-Fi to stranded mariners during the Francis Scott Key Bridge collapse, showcasing its flexibility and responsiveness to diverse, emergent needs. The Project Connect initiative, launched during the pandemic, further illustrates this adaptability by providing widespread internet access to underserved and rural communities, with many sites still operational today.

Perhaps the most significant development highlighted by Furr is the establishment of ITDRC's Cyber Incident Support Team (CIST). This initiative represents a forward-looking recognition that cyberattacks can be as devastating as physical disasters, paralyzing critical services and organizations. The CIST is designed to provide immediate technical assistance—including temporary internet, parallel network builds, and desktop re-imaging—to government, education, and utility sectors in the wake of a cyber event. This expansion marks a crucial evolution in ITDRC's mission, addressing the growing intersection of physical and digital resilience.

Finally, the presentation underscored the vital role of ITDRC's Remote Response Team. These individuals, operating away from the immediate disaster zone, provide essential situational awareness, mobilization instructions, and project oversight. They act as the first line of defense for help desk inquiries and manage critical logistics, ensuring that field teams receive necessary equipment and support. This dual-pronged approach, combining on-the-ground action with robust remote coordination, is fundamental to ITDRC's operational effectiveness and sustained impact.

Technical Deep Dive

▶ Watch: Speaker's background and leadership role at ITDRC (11:00)

ITDRC's technical operations are characterized by their adaptability, resourcefulness, and the deployment of a wide array of networking and communication technologies. The core challenge in disaster response is often operating in environments with compromised or non-existent infrastructure, requiring volunteers to build robust, temporary networks from the ground up, often with limited resources and under immense time pressure.

Furr detailed several key technologies and methodologies employed by ITDRC. For establishing internet connectivity in grid-down scenarios, cellular backhaul is frequently utilized, leveraging available mobile networks to provide an uplink. This is often paired with localized mesh Wi-Fi networks to distribute internet access across a broader area. In situations requiring connectivity over significant distances or across physical barriers, point-to-multipoint wireless bridges are deployed. A specific example from the Finger Lakes operation involved using a Ubiquiti UniFi LightBridge to span an "incrossable gap," demonstrating their capability to establish high-bandwidth links where traditional cabling is impossible.

The flexibility required in the field means that ITDRC volunteers must be proficient with various vendor ecosystems. The Finger Lakes exercise, for instance, combined a cellular backhaul with a Meraki network for local distribution and the UniFi LightBridge for the long-distance link. This scenario vividly illustrated the need for deep technical understanding and on-the-fly problem-solving. Furr recounted how a meticulously planned setup went awry, forcing volunteers to make a patch cable in the middle of the woods and meticulously review "16 pages of technical documentation" to diagnose and resolve issues with mesh access point configuration. This highlights that theoretical knowledge must be coupled with practical, hands-on improvisation.

Deployments like those during Hurricane Milton further exemplify the diverse technical challenges. At a decommissioned prison repurposed for volunteer housing, ITDRC set up Wi-Fi and internet access. In other locations, they established connectivity in tents for community feeding centers. A notable deployment was at a state-run donation warehouse, where ITDRC installed a full network, including numerous access points, a Starlink terminal for satellite internet, and a VoIP center. This enabled the state to centralize and coordinate donation logistics across the entire region—a complex undertaking involving running Cat6 cabling through warehouse rafters and configuring multiple network devices. Each site presented unique requirements, ranging from simple drop-and-go cellular gateways and access points to multi-building, multi-campus network builds, often requiring roof access for satellite dishes or antenna installations.

The Project Connect initiative, born out of the pandemic, showcased ITDRC's ability to leverage existing infrastructure while deploying their own wireless gear to create public Wi-Fi hotspots for underserved and rural communities. This project served over 25 states and several U.S. territories, with many of these sites still providing essential connectivity today.

The newly formed Cyber Incident Support Team (CIST) represents a significant technical expansion. This team is being equipped with dedicated technical assets to provide immediate aid to government, education, and utility organizations post-cyber incident. Their technical capabilities include establishing temporary internet connectivity, building parallel networks to isolate compromised systems and restore essential services, and performing mass re-imaging of desktops and servers. This requires a deep understanding of network segmentation, security best practices, and rapid deployment of clean infrastructure, effectively acting as a "cyber reconstruction" crew. The CIST demands skilled cyber defenders capable of not just identifying threats but actively rebuilding and securing operational environments.

Supporting these field operations is the Remote Response Team, based in Dallas. This team provides crucial logistical and technical support, including situational awareness through OSINT, generating mobilization instructions, and offering project oversight. They act as a central help desk for field teams encountering issues and manage the complex logistics of shipping specialized equipment to remote disaster zones, ensuring that volunteers have the necessary tools to accomplish their mission.

Demo / Proof of Concept

▶ Watch: Past major ITDRC disaster responses (e.g., hurricanes, wildfires) (14:00)

While the talk did not feature a live, in-person demonstration of ITDRC's capabilities, the speaker vividly detailed several real-world deployments and a significant field exercise that served as a crucial proof of concept for the organization's methodologies and the adaptability of its volunteers.

The primary example of a practical proof of concept was the Finger Lakes operation, which was Impos73r's first ITDRC deployment and a simulated grid-down scenario near Ithaca, New York. The objective was to bridge an "immovable" or "incrossable gap" without direct physical access to the other side. The team deployed a cellular backhaul at their head end, establishing initial internet connectivity. This was integrated into a Meraki network for local distribution and then extended across the gap using a Ubiquiti UniFi LightBridge. On the remote side, volunteers hiked in with the other half of the light bridge and a mesh access point to provide Wi-Fi. This exercise tested their ability to deploy complex wireless infrastructure in challenging terrain, overcome technical hurdles (such as unexpected mesh AP configuration issues and the need to improvise a patch cable), and adapt to environmental factors like an encroaching rainstorm. This hands-on simulation proved the viability of their approach to establishing connectivity in austere, disconnected environments.

Further evidence of ITDRC's operational proof of concept comes from the extensive real-world deployments recounted, particularly during Hurricane Milton. These operations, spread across Florida, showcased the varied technical challenges and solutions. From setting up basic Wi-Fi and internet for volunteers housed in a decommissioned prison, to establishing internet access in community feeding tents, to deploying a full-scale network with Starlink and a VoIP center in a donation warehouse, each scenario was a practical demonstration of ITDRC's capacity to meet diverse needs. The successful coordination of donations through the state-set-up warehouse, facilitated by ITDRC's network, stands as a powerful testament to the tangible impact of their technical interventions. These real-world deployments, though not formal "demos" in a conference setting, served as undeniable proof of ITDRC's effectiveness and the critical skills of its volunteer force.

Defensive Implications

▶ Watch: ITDRC's involvement in planned events like World Games (14:50)

The work of ITDRC, particularly its expansion into cyber incident response, carries significant defensive implications for organizations and the broader cybersecurity community. Firstly, the very existence of ITDRC's Cyber Incident Support Team (CIST) highlights a growing recognition that cyberattacks, much like natural disasters, can severely disrupt or destroy an organization's operational capacity. This underscores the need for robust disaster recovery plans that explicitly account for cyber resilience, including strategies for establishing parallel networks, rapid data recovery, and secure system re-imaging. Organizations, especially those in the government, education, and utility sectors, should view CIST as a potential lifeline in the wake of a catastrophic cyber event.

For defenders, the talk emphasizes the critical importance of foundational IT skills beyond specialized cybersecurity knowledge. While preventing breaches is paramount, the reality is that incidents occur. The ability to quickly rebuild and secure infrastructure—deploying temporary networks, configuring access points, managing cellular backhaul, and troubleshooting complex systems under pressure—becomes invaluable. This suggests that cybersecurity professionals should cultivate a broader skill set in network engineering, systems administration, and physical infrastructure deployment, as these are precisely the skills needed for post-breach recovery. The "thinking on your feet" and troubleshooting capabilities highlighted by Furr are essential for any defender, whether responding to a live attack or rebuilding after one.

Moreover, ITDRC's model demonstrates the power of community and volunteerism in strengthening collective resilience. The call for skilled cyber defenders to join the CIST is a direct appeal to leverage specialized expertise for public good. This provides an avenue for cybersecurity professionals to contribute their skills to help organizations recover from devastating cyberattacks, offering a unique form of "cyber first responder" service. This collective effort can enhance the overall security posture of critical sectors that might otherwise lack the immediate resources for extensive post-incident recovery.

Finally, the talk implicitly advocates for proactive engagement with disaster preparedness. Understanding how organizations like ITDRC operate can inform internal disaster recovery planning. For instance, considering how temporary internet and communication systems could be rapidly deployed, or how a compromised network could be segmented and rebuilt, are vital components of a comprehensive defensive strategy. The emphasis on securing basic connectivity in times of crisis reinforces that operational continuity, even in a degraded state, is a key defensive objective.

Key Takeaways

• ITDRC Fills a Critical Gap: The Information Technology Disaster Resource Center (ITDRC) provides essential IT and communication infrastructure to communities affected by disasters, recognizing connectivity as a fundamental need alongside basic humanitarian aid.
• Adaptability is Paramount: Field deployments demand extreme adaptability, on-the-fly troubleshooting, and creative problem-solving from volunteers, as pre-planned solutions rarely survive contact with real-world disaster zones.
• Expanding Scope of Disaster Response: ITDRC's work extends beyond natural disasters to include planned events, unique humanitarian crises (e.g., stranded mariners), and crucial initiatives like Project Connect for underserved communities.
• Cyber Incident Support is a New Frontier: The newly formed Cyber Incident Support Team (CIST) addresses the growing need for post-breach IT recovery for government, education, and utility sectors, providing temporary networks and system rebuilds after cyberattacks.
• Volunteering Offers Unique Impact: Joining ITDRC provides cybersecurity professionals and IT experts with a unique opportunity to apply their skills in high-impact, real-world scenarios, making a direct difference in people's lives.
• Connectivity is Core to Resilience: Whether facing physical destruction or a cyberattack, the ability to rapidly establish and maintain operational connectivity is critical for recovery, coordination, and community well-being.

About the Speaker(s)

The speaker, Impos73r, also known as Ian Furr, is a dedicated and multi-faceted professional in the fields of cybersecurity and emergency response. He serves as a voluntech with the Information Technology Disaster Resource Center (ITDRC), where he is also the Deputy Director for Region 3, overseeing operations in DC, Delaware, Maryland, Pennsylvania, Virginia, and West Virginia.

In his day job, Ian is a Senior Cybersecurity Automation and Integrations Engineer at the Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC), applying his expertise to secure critical infrastructure within those industries. Beyond his professional and ITDRC commitments, Ian volunteers his time as an EMT in Fairfax County and contributes to a communications cache in Virginia, demonstrating a broad and deep commitment to public service and emergency preparedness. He can be found online as @hackoutside.com.